Comment by InsidiousWombat
1 day ago
DoH was mostly forced by few companies, it doesn't solve any real problems because the places that would like to spy on your DNS can just block few DoH providers that are used by default. Like, it's nice to have that random MITM can't see your DNS but if ISP wants it, they can just block it.
This mostly describes the difference between DoT (which is trivial to block) and DoH (which is deliberately harder to block). Are you aware of any ISP blocking DoH?
https://github.com/net4people/bbs/issues/295 China for example ?
It's just few IPs on a known port. It's trivial to block.
now if the cloud providers ran it on every of their internet facing load balancers so you could use any of their IPs for DNS maybe it would be more effective, but as it is, it is entirely trivial to block it.
We actually did it for corporate network for entirely different reason, we just have a bunch of internal-only DNS zones and want browser to use that.
The whole point of DoH is that the "known port" is the encrypted one the whole Internet runs over (443/tcp), which makes it more difficult to block than DoT.